Security researchers at Hacktron say AI agents helped them compress months of vulnerability research into days. During an investigation targeting OpenAI’s systems, the team used AI agents to perform a substantial share of the work involved in developing an exploit chain.
An attacker can try an exploit, fail, and try again. A defensive agent that disables the wrong account or isolates a production server can interrupt legitimate business operations.
The UK’s National Cyber Security Centre (NCSC) addresses this problem in its guidance on agentic defense. Organizations remain accountable for the actions their defensive agents take, including mistakes that affect legitimate users or critical systems.
That leaves security operations center (SOC) leaders with a difficult decision about how much authority to give defensive agents.
An agentic SOC uses AI agents to triage alerts, investigate suspicious activity, and carry out response actions across existing security tools. Agents can follow investigative leads, gather evidence, and decide what to investigate next without relying on a predefined playbook for every step.
Security teams set the limits on what agents can do without approval. An agent investigating a suspicious login might recommend disabling an account, for example, but it can only act independently if the team has authorized it to do so.
Two vendors may both promise autonomous investigations while giving their agents very different levels of access to production systems.
The NCSC proposes five dimensions for assessing automated defensive actions: potency, scope, criticality, rollout confidence, and recoverability.
Recommending an IP block is one thing. Disabling accounts or changing security controls comes with a far greater risk. Establish which actions the agent is able to take without human approval.
Find out whether administrators can limit an agent’s access to specific accounts and resources, or whether its permissions extend across the cloud environment. Those limits should also apply to the other security tools it can access.
An agent should know whether it’s about to isolate a test workstation or a production database. Ask how it identifies business-critical systems and accounts for the consequences of taking them offline.
Ask vendors for results from their live deployments. This should include investigation errors and instances where analysts had to intervene. In addition, find out how they test agents before letting them take on more actions without approval.
Check whether analysts can stop an action in progress and reverse any changes the agent has made. Some actions may require manual recovery, so teams need to test what happens when an automated response goes wrong.
Prophet Security, for example, uses an agent to investigate each alert and return a determination with supporting evidence. Analysts can review that evidence and check how the agent reached its conclusion. Its scoped Agent Actions can operate autonomously or require human sign-off, with integrations across the existing security stack.
An agentic SOC evaluation should test these capabilities alongside investigation accuracy and detection coverage.
The NCSC recommends starting with lower-potency actions, such as providing recommendations analysts can review or carrying out actions within strict limits. Teams can expand an agent’s permissions once testing shows it can perform those tasks reliably.
A previously published list of agentic SOC vendors provides some background on the market. The NCSC’s five criteria offer a way to examine six vendors worth watching in 2027.
A leading AI SOC platform for enterprise security teams, Prophet Security reports deployments at dozens of Fortune 500 companies. Its agents document how every determination was reached and act through scoped Agent Actions, autonomously or with human sign-off. In a side-by-side evaluation at a Fortune 500 manufacturer, its determinations reached 98.5% agreement with the human analyst team across 12,000 investigations. How much autonomy will buyers grant on that record?
7AI raised a record $130 million cybersecurity Series A and develops agents that autonomously investigate security alerts. Buyers need to establish what actions those agents can take without human approval.
Dropzone AI uses autonomous AI analysts to investigate security alerts and present their findings to human teams. Buyers should examine the evidence behind those findings and whether analysts can independently retrace the investigation to verify how the agent reached its conclusion.
Exaforce uses a real-time knowledge graph to detect attacks as they unfold, backed by $125 million in Series B funding. Buyers should examine how far its automated actions can reach across connected systems and whether administrators can restrict them to specific resources.
Torq’s Socrates agentic capabilities run on an established security workflow engine. Buyers should test whether that architecture makes it easier to reverse an incorrect automated action.
Vega performs security analytics and response where data already resides, without requiring centralized ingestion. Following its reported $120 million Series B, a question for buyers is how the platform accounts for the criticality of systems across those distributed environments.
Gartner predicts that more than 40% of agentic AI projects will be canceled by the end of 2027. The forecast covers agentic AI generally, rather than security operations specifically. Still, buyers committing to a new platform need to consider whether the product they evaluate today will offer the same capabilities and support a year from now.
Established security vendors are also introducing AI agents into their platforms. Microsoft, Palo Alto Networks, and CrowdStrike have existing customer bases and integrations that may appeal to organizations looking to extend their current security tools. Their agents need the same scrutiny, particularly around the permissions they receive and the evidence they provide for their actions.
Research reported by Help Net Security found that 40% of large companies had experienced an AI-related compliance or governance issue in the previous 12 months. The research identified problems with governance processes designed around human users, which struggle to account for autonomous systems.
Accurate investigations don’t tell you whether an agent can safely act on its findings. A platform might consistently identify malicious activity and still cause disruption if it takes an inappropriate response action.
Before the next proof of concept or renewal, put the NCSC’s five criteria into the evaluation. Ask vendors to demonstrate what happens when an agent makes the wrong call, particularly when its actions affect production systems.
